Oh, something I'd like: shared resources between apps, each with their own access levels. For example, say my "photo processing" service has a queue. Other services should be able to access that queue to enqueue things. I think we'd need the concept of resource ownership

This sounds like it would be addressed by what we've been calling "dynamic linking" (https://github.com/pulumi/pulumi/issues/109) The Workaround Joe eludes to is that we had some customers that factored their app into multiple layers (a data layer, a networking layer and an app layer, for example) and then would export the AWS IDs of relevant pieces of their infrastructure, and then set these ARNs as config on upstack components. It works, but its not nearly as slick as what you're describing. I'd encourage you take a look at the issue and provide feedback there. It's one of the "big problems" we'd want to go after, but the design still needs to be nailed down. The design of Pulumi has shifted a lot since October 🙂.

Oh, that's really interesting! I'll need to mull this over when I have time.